Upgrading laravel/framework 11 to 12
Breakingv11.57.1 → v12.70.2Breaking14Security20Deprecated3New416Changed329Fixed466Other438
Fetching 121 releases from GitHub…120 / 121
BreakingUpgrade verdict
14 breaking changes and 19 security fixes.
In plain terms
- Renames NamedScope to Scope.
- A property on a framework class has a new name, so code reading the old name will stop working.
- The cache-based password reset feature no longer accepts a prefix setting.
- Removes the Model intersection from the UserProvider contract.
Must act Top 5 of 36 that need code or config changes
laravel/framework publishes an official migration guide for version 12. It covers more than the release notes do.
Laravel 12 upgrade guide ↗What you must change
Breaking14
Renames NamedScope to Scope.
NamedScopeScopeRenames the
group property to messageGroup.groupmessageGroupRemoves the "prefix" option for cache password resets.
prefixRemoves the Model intersection from the UserProvider contract.
UserProviderModelRemoves apc support.
apcRemoves support for Carbon v2.
Reverts aliasing when selecting database expressions.
Reverts the EnumerateValues::value() support and negative value handling.
EnumerateValues::value()Reverts the reintroduction of the short-hand "false" syntax for Blade component props.
Replaces the logger helper and log function return type ?LogManager with abstract ?LoggerInterface.
logger()log()LogManagerLoggerInterfaceFixes a base class guard in return types that was breaking custom guards.
Changes return types of paginate() methods to \Illuminate\Pagination\LengthAwarePaginator.
paginate()\Illuminate\Pagination\LengthAwarePaginatorForces Eloquent\Collection::partition to return a base Collection.
Eloquent\Collection::partition()CollectionChanges --memory=0 to mean skip memory exceeded verification.
--memorySecurity19
Prevents escaping from bypassing protection.
Laravel: XSS in Debug Page Information
Low · CVSS 3.1Ensures the password hash matches the stored cookie before authenticating the user.
Laravel TokenGuard authentication bypass through non-string API credentials
CriticalLaravel relationship inclusion can trigger unauthorized data destruction
Moderate · CVSS 6.5Restricts temporary upload URL handling so the
upload value is fetched only from the request's query string.uploadFixes the
in validation rule being bypassed via loose comparison.inGuards the JsonSchema deserializer against unbounded $ref expansion.
JsonSchemaLaravel Framework: Temporary Signed URL Path Confusion
Moderate · CVSS 4.2Laravel Framework: CRLF injection in default email rule
High · CVSS 8.9Narrows the allowed URL schemes for attachments.
Enforces a commonmark version without the DisallowedRawHtmlRenderer exploit.
composer.jsonDisallowedRawHtmlRendererAdds a JSONP check.
Updates phpunit version constraints to address a CVE.
Changes the remember cookie to store a MAC of the user's password hash instead of the real password hash.
Enforces same origin on redirect responses.
Laravel has a File Validation Bypass
ModeratePrevents XSS vulnerabilities by excluding SVGs by default in image validation.
Allows limiting bcrypt hashing to 72 bytes to prevent insecure hashes.
bcryptDeprecations to plan for
Deprecated3
Adds a deprecation to Request::get().
Request::get()Handles the brick/math of float deprecation.
ofDeprecates Factory::$modelNameResolver.
Factory::$modelNameResolver